CVE-2024-3582

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-358215.5In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in the correct place Page cache reads are locCVE-2024-358225.5In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible triggerCVE-2024-358235.3In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is theCVE-2024-358245.5In the Linux kernel, the following vulnerability has been resolved: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspCVE-2024-358255.5In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling of zero block length packets While connCVE-2024-358265.5In the Linux kernel, the following vulnerability has been resolved: block: Fix page refcounts for unaligned buffers in __bio_release_pages(CVE-2024-358275.5In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "contrCVE-2024-358285.5In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the CVE-2024-358295.5In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix a memleak in lima_heap_alloc When lima_vm_map_bo fails, CVE-2024-35836.4The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions CVE-2024-358305.5In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setupCVE-2024-358315.5In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix release of pinned pages when __io_uaddr_map fails Lookin
CVE-2024-3582: Medium severity, CVSS 4.8 | Vulnix